topic Clients/Server do not have assigned endpoint group ALERT / CORRELATION / XQL in Cortex XDR Discussions

Clients/Server do not have assigned endpoint group ALERT / CORRELATION / XQL

RFeyertag — Thu, 15 Jun 2023 17:28:27 GMT

Hello dear community,

I want to share with you my little XQL script which can identify and alert connected Clients which have no assigned endpoint group.

This can happen:

- Cortex is installed, but the endpoint name does not match the defined criteria

- Endpoint name is changed, does not match the defined criteria

dataset = endpoints
| filter group_names != "*"
| filter endpoint_status ~= "CONNECTED" and endpoint_status !~= "DISCONNECTED"

Rob

Re: Clients/Server do not have assigned endpoint group ALERT / CORRELATION / XQL

bbarmanroy — Fri, 16 Jun 2023 08:52:51 GMT

Good work there, @RFeyertag !
A few observations:
I'd recommend changing the operator in 3rd line to not do regex as the values can always be an exact match (CONNECTED/DISCONNECTED).

So something like this :

| filter endpoint_status= ENUM.CONNECTED or endpoint_status = ENUM.DISCONNECTED

| filter endpoint_status in (ENUM.CONNECTED , ENUM.DISCONNECTED )

will do too.

Re: Clients/Server do not have assigned endpoint group ALERT / CORRELATION / XQL

RFeyertag — Sun, 18 Jun 2023 20:01:10 GMT

Thank you @bbarmanroy,

with your recommendation it works much better!

Rob